CVE-2026-18073: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...

VulnCheck KEV: CVE-2026-58457

Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilterconf handler in the commuos web backend. Attackers...

CVE-2026-17499: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-53932: Improper Neutralization of Special Elements used in a Command

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4...

CVE-2026-85223

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224

CVE-2026-85224 is an OS command injection vulnerability in the File Sharing component of D-Link DNS-320 ShareCenter (firmware 2.06B01), specifically in /cgi/file_sharing.cgi. Manipulation of the fileurl argument allows a remote attacker to execute arbitrary commands. The CVSS 3.1 score is 9.1 (CR...

CVE-2026-85222

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85223 D-Link DNS-340L CGI dropbox.cgi os command injection

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85223 D-Link DNS-340L CGI dropbox.cgi os command injection

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

CVE-2026-85223

CVE-2026-85223 affects D-Link DNS-340L firmware version 1.01B04 . The vulnerability is an OS command injection in the CGI Handler component, specifically in the file /cgi-bin/dropbox.cgi. Manipulating the callback_url and sync_interval arguments allows a remote, authenticated attacker to inject a...

EUVD-2026-70748

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222

D-Link DNS-340L (firmware 1.01B04) is affected by an OS command injection in the Add-On Center component, specifically in /cgi-bin/addon_center.cgi. Manipulation of the f_name, f_url, f_flag, and f_login_user arguments allows remote code execution. The attack requires high privileges (authenticat...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2026-85012

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-85012 OS command injection in the Amazon CodeCatalyst blueprints SDK

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-85012

AWS codecatalyst-blueprints (the blueprint resynthesis framework in the npm package) before version 0.3.156 is vulnerable to OS command injection (CWE-78). A user with permission to commit to a project repository can execute arbitrary commands in the resynthesis environment by embedding shell met...